24 / 75 · 08 Infrastructure as Code Testing · Minimal Container Images← prev⊞ allnext →☰ Read as one page
5.2Image Size and Vulnerability Comparison
| Base Image | Compressed Size | Packages | CVEs (typical) | Use Case |
|---|---|---|---|---|
node:20 |
~350 MB | 400+ | 50-200 | Development only |
node:20-slim |
~80 MB | ~100 | 10-30 | Build stages |
node:20-alpine |
~50 MB | ~30 | 5-15 | Production (if musl-compatible) |
distroless/nodejs20 |
~40 MB | ~10 | 0-5 | Production (recommended) |
scratch + static binary |
<10 MB | 0 | 0 | Go/Rust applications |
The difference between 200 CVEs and 0 CVEs is not about better patching -- it is about having fewer things to patch. Distroless images achieve near-zero vulnerability counts by removing everything except the language runtime.